feat(security): comprehensive security hardening for tunnel and core services

apps/mobile/lib/secure-storage.ts

@@ -0,0 +1,34 @@
+import AsyncStorage from "@react-native-async-storage/async-storage"
+import * as SecureStore from "expo-secure-store"
+
+const availability: Promise<boolean> = SecureStore.isAvailableAsync().catch(() => false)
+
+export const secureStorage = {
+    getItem: async (name: string): Promise<string | null> => {
+        if (await availability) {
+            const value = await SecureStore.getItemAsync(name)
+            if (value !== null) return value
+            const legacy = await AsyncStorage.getItem(name)
+            if (legacy !== null) {
+                await SecureStore.setItemAsync(name, legacy).catch(() => undefined)
+                await AsyncStorage.removeItem(name).catch(() => undefined)
+            }
+            return legacy
+        }
+        return await AsyncStorage.getItem(name)
+    },
+    setItem: async (name: string, value: string): Promise<void> => {
+        if (await availability) {
+            await SecureStore.setItemAsync(name, value)
+            await AsyncStorage.removeItem(name).catch(() => undefined)
+            return
+        }
+        await AsyncStorage.setItem(name, value)
+    },
+    removeItem: async (name: string): Promise<void> => {
+        if (await availability) {
+            await SecureStore.deleteItemAsync(name).catch(() => undefined)
+        }
+        await AsyncStorage.removeItem(name).catch(() => undefined)
+    },
+}

apps/mobile/package.json

@@ -32,6 +32,7 @@
     "expo-linking": "^57.0.5",
     "expo-notifications": "~57.0.10",
     "expo-router": "^57.0.11",
+    "expo-secure-store": "~57.0.0",
     "expo-speech-recognition": "^56.0.1",
     "expo-splash-screen": "~57.0.5",
     "expo-status-bar": "~57.0.1",

apps/mobile/store/auth.store.ts

@@ -1,6 +1,6 @@
-import AsyncStorage from "@react-native-async-storage/async-storage"
 import { create } from "zustand"
 import { createJSONStorage, persist } from "zustand/middleware"
+import { secureStorage } from "../lib/secure-storage"
 
 type User = {
     id: string
@@ -33,7 +33,7 @@ export const useAuth = create<AuthStore>()(
         }),
         {
             name: "crosscode-auth",
-            storage: createJSONStorage(() => AsyncStorage),
+            storage: createJSONStorage(() => secureStorage),
         }
     )
 )

apps/mobile/store/connection.store.ts

@@ -1,6 +1,6 @@
-import AsyncStorage from "@react-native-async-storage/async-storage"
 import { create } from "zustand"
 import { createJSONStorage, persist } from "zustand/middleware"
+import { secureStorage } from "../lib/secure-storage"
 
 let nextID = 1
 
@@ -77,7 +77,12 @@ export const useConnections = create<ConnectionStore>()(
         }),
         {
             name: "crosscode-connections",
-            storage: createJSONStorage(() => AsyncStorage)
+            storage: createJSONStorage(() => secureStorage),
+            partialize: (state) => ({
+                connections: state.connections.map(({ healthy, ...rest }) => rest),
+                current: state.current,
+                activeConnections: state.activeConnections,
+            }),
         }
     )
 )

packages/crosscode/src/config.ts

@@ -105,7 +105,7 @@ export function ensureSessionToken(config: Config, project?: ProjectConfig): str
 export function ensureProjectId(config: Config, project?: ProjectConfig): string {
     const target = project ?? getProjectConfig(config)
     if (!target.projectId) {
-        target.projectId = crypto.randomBytes(4).toString("hex")
+        target.projectId = crypto.randomBytes(16).toString("hex")
         saveProjectConfig(config)
         logCrosscode(`Project ID generated for ${process.cwd()}: ${target.projectId}`)
     } else {

packages/tunnel-server/src/proxy.ts

@@ -13,6 +13,30 @@ import type { WebSocket } from "ws"
 import { logger } from "./logger.js"
 import { createQuestionPushObserver, createSsePushObserver } from "./push-events.js"
 
+const RATE_LIMIT_WINDOW = 60_000
+const MAX_REQUESTS_PER_WINDOW = 120
+const MAX_RATE_LIMIT_KEYS = 10_000
+const rateLimits = new Map<string, { count: number; resetAt: number }>()
+
+function checkRateLimit(key: string): { allowed: boolean; retryAfter: number } {
+  const now = Date.now()
+  let limit = rateLimits.get(key)
+  if (!limit || now > limit.resetAt) {
+    if (rateLimits.size >= MAX_RATE_LIMIT_KEYS) {
+      for (const [k, v] of rateLimits) {
+        if (v.resetAt <= now) rateLimits.delete(k)
+      }
+    }
+    limit = { count: 0, resetAt: now + RATE_LIMIT_WINDOW }
+    rateLimits.set(key, limit)
+  }
+  limit.count++
+  return {
+    allowed: limit.count <= MAX_REQUESTS_PER_WINDOW,
+    retryAfter: Math.max(1, Math.ceil((limit.resetAt - now) / 1000)),
+  }
+}
+
 export function handleProxy(req: IncomingMessage, res: ServerResponse): void {
   const url = req.url || "/"
   const method = req.method || "GET"
@@ -48,6 +72,15 @@ export function handleProxy(req: IncomingMessage, res: ServerResponse): void {
     return
   }
 
+  const clientIp = req.socket.remoteAddress || "unknown"
+  const limit = checkRateLimit(`${projectId}:${clientIp}`)
+  if (!limit.allowed) {
+    logger.warn("Rate limit exceeded for tunnel", { projectId, path, method })
+    res.writeHead(429, { "Content-Type": "application/json", "Retry-After": String(limit.retryAfter) })
+    res.end(JSON.stringify({ error: "Too many requests. Please try again later." }))
+    return
+  }
+
   const reqId = generateReqId()
   recordRequestStart(projectId)
   const hasAuth = !!req.headers["authorization"]